[FEATURE] Support HTTPS proxy

[zonyitoo]

Does any one really need this?

[dev4u]

Similar to shadowsocks/v2ray-plugin#76 shadowsocks/v2ray-plugin#134 ?

[dev4u]

If so, I hope the ssserver can be support h2c.

[Mygod]

Do you mean CONNECT verb in HTTP proxy?

[zonyitoo]

Do you mean CONNECT verb in HTTP proxy?

Nope. I mean communicating with proxy with https protocol instead of http.

[zonyitoo]

If so, I hope the ssserver can be support h2c.

No. We are discussing https protocol in sslocal.

sslocal <-> ssserver will always be shadowsocks' protocol.

[zonyitoo]

It will eventually become a MITM proxy.

What if client just connects proxy with HTTPS, and then uses CONNECT method to connect remote targets?

Ref: CURLPROXY_HTTPS

[Mygod]

I checked curl's implementation and I think HTTPS proxy is just HTTP proxy over TLS, not MITM. I don't see any reasonable use case for this as we usually assume sslocal runs in a trusted environment.

By the way, socks5 is backwards compatible with socks4/4a. If you really want to go overboard with this, you can identify the incoming connection type (socks5/4/4a/http) by probing the first byte. I think that is what is done in shadowsocks-windows.

[Mygod]

If you are looking for some kind of MitM, you might be referring to SNI proxy instead, e.g. https://github.com/dlundquist/sniproxy

I do not see reasonable use case for this either -- even if there is, a separate binary can easily achieve this.

[zonyitoo]

By the way, socks5 is backwards compatible with socks4/4a. If you really want to go overboard with this, you can identify the incoming connection type (socks5/4/4a/http) by probing the first byte. I think that is what is done in shadowsocks-windows.

I know. The only reason that I don't want to implement it is lazy...

I checked curl's implementation and I think HTTPS proxy is just HTTP proxy over TLS, not MITM. I don't see any reasonable use case for this as we usually assume sslocal runs in a trusted environment.

For curl's implementation, it is just a HTTP proxy over TLS. But for mitmproxy, it acts like a transparent HTTPS proxy, which is eventually a MITM proxy.

And yes, I don't think it is necessary to support HTTP proxy over TLS for sslocal.

[Mygod]

Same thing for mitmproxy. If you want to use it, just use a separate binary.

[zonyitoo]

I don't. This issue is just an idea pop up in my mind.